build_alpine_images.yml

name: Build Alpine images

on:
  workflow_dispatch:
  push:
    branches: [main]
  schedule:
    - cron: '0 5 * * 1'

jobs:
  build:
    name: Build
    strategy:
      matrix:
        include:
          - stunnel_version: 5.71-r0
            alpine_version: 3.18.3
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Force build if workflow_dispatch or re-run
        id: force
        if: github.event_name == 'workflow_dispatch' || github.run_attempt != '1'
        run: echo "FORCE=1" >> $GITHUB_ENV
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Log in to GHCR
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build GHCR tag (if needed)
        working-directory: alpine
        env:
          IMAGE_NAME_ROOT: ghcr.io/${{ github.repository_owner }}/
          STUNNEL_VERSION: ${{ matrix.stunnel_version }}
          ALPINE_VERSION: ${{ matrix.alpine_version }}
        run: bash build_container.sh
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/${{ github.repository_owner }}/stunnel:${{ matrix.stunnel_version }}-alpine-${{ matrix.alpine_version }}
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'